Executive Summary
On July 26, 2026, the ransomware group EXFILSQUAD publicly claimed responsibility for a substantial data breach targeting Microsoft, allegedly exfiltrating approximately eight million records. The group asserts that the stolen dataset includes personally identifiable information (PII), authentication hashes, and internal corporate records. However, at this time, Microsoft has not confirmed a breach, and the attackers have failed to provide any file samples, screenshots, or proof-of-concept data to validate their claims.
EXFILSQUAD has a documented history of posting fabricated victim claims and engaging in information warfare to damage corporate reputations or generate media attention. Consequently, threat intelligence analysts currently view this claim with high skepticism. Despite the lack of verification, the potential impact of such a breach—should it prove authentic—would be severe given the sensitivity of the alleged data, which ranges from facility management details to employee credentials.
Key Details
Threat Name
EXFILSQUAD Ransomware
Affects
—
Adversary
EXFILSQUAD Other Adversaries and Aliases: PEAR; Clop; D1R; Royal Ransomware; Agentic JADEPUFFER
MITRE Techniques
—
Malware/Tools
EXFILSQUAD